{"record":{"id":"c3ead960ad2d4e00","repo":"quarkusio/quarkus","slug":"unable-to-verify-alias-alias-in-jks-trust-sto","errorCode":null,"errorMessage":"Unable to verify alias '${alias}' in JKS trust store '${name}'","messagePattern":"Unable to verify alias '(.+?)' in JKS trust store '(.+?)'","errorType":"exception","errorClass":"java.lang.IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/JKSKeyStores.java","lineNumber":152,"sourceCode":"            } catch (KeyStoreException | NoSuchAlgorithmException e) {\n                throw new IllegalStateException(\"Unable to verify alias '\" + alias + \"' in JKS key store '\" + name + \"'\", e);\n            } catch (UnrecoverableKeyException e) {\n                throw new IllegalArgumentException(\n                        \"Unable to recover the key for alias '\" + alias + \"' in JKS key store '\" + name + \"'\", e);\n            }\n        }\n    }\n\n    private static void verifyTrustStoreAlias(JksOptions options, String name, KeyStore ks) {\n        String alias = options.getAlias();\n        if (alias != null) {\n            try {\n                if (ks.getCertificate(alias) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in JKS trust store (certificate not found)'\" + name + \"'\");\n                }\n            } catch (KeyStoreException e) {\n                throw new IllegalStateException(\"Unable to verify alias '\" + alias + \"' in JKS trust store '\" + name + \"'\", e);\n            }\n        }\n    }\n\n    private static KeyStore loadKeyStore(Vertx vertx, String name, JksOptions options, String type) {\n        try {\n            return options.loadKeyStore(vertx);\n        } catch (Exception e) {\n            throw new IllegalStateException(\"Unable to load JKS \" + type + \" store '\" + name + \"', verify the password.\", e);\n        }\n    }\n}\n","sourceCodeStart":134,"sourceCodeEnd":165,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/JKSKeyStores.java#L134-L165","documentation":"Thrown by JKSKeyStores.verifyTrustStoreAlias when checking the configured alias in a JKS trust store raises a KeyStoreException or NoSuchAlgorithmException. The alias lookup ks.getCertificate(alias) can fail for store-level reasons (uninitialized or corrupt store) independent of whether the alias exists; those checked exceptions are caught and rethrown as this IllegalStateException with the store name and original cause, distinguishing infrastructure failure from the 'alias not found' case.","triggerScenarios":"verifyTrustStoreAlias (JKSKeyStores.java:151-152) during verifyJKSTrustStoreStore when the loaded KeyStore instance is not in an operational state (uninitialized keystore or provider failure).","commonSituations":"Custom security provider issues; corrupted trust store causing the JKS implementation to fail; native-image provider registration problems.","solutions":["Inspect the wrapped cause for the underlying KeyStoreException.","Validate the trust store with keytool -list to confirm it is not corrupted.","Retest without custom security providers / with the default JDK JKS implementation."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"try {\n    KeyStore ts = KeyStore.getInstance(\"JKS\");\n    try (var in = java.nio.file.Files.newInputStream(java.nio.file.Path.of(truststorePath))) {\n        ts.load(in, storePassword.toCharArray());\n    }\n    ts.getCertificate(alias);\n} catch (java.security.KeyStoreException e) {\n    throw new IllegalStateException(\"Trust store unusable: \" + e.getMessage(), e);\n}","typeGuard":null,"tryCatchPattern":"try {\n    // startup\n} catch (IllegalStateException e) {\n    if (e.getMessage() != null && e.getMessage().contains(\"in JKS trust store\")) {\n        log.errorf(e.getCause(), \"KeyStoreException verifying trust store alias %s\", alias);\n    }\n    throw e;\n}","preventionTips":["Validate trust stores with keytool after every regeneration.","Avoid custom security providers unless validated on the target image.","Keep runtime JDK and keystore tooling versions aligned."],"tags":["tls","jks","truststore","alias","keystoreexception"],"backgroundTag":"keystore-alias-not-found","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}